diff --git a/changelog.html b/changelog.html
index 9f770ca9c85e1353651bb3624cefb4be9fcff763..7df33fa4419f5fb3ef4c98eb2b998bad25b05763 100644
--- a/changelog.html
+++ b/changelog.html
@@ -65,6 +65,9 @@ Upcoming changes
(issue 12529)
Matrix job now allows delete whole matrix, including sub-jobs.
+
+ Fixed a bug in LDAP default root DN inference.
+ (issue 8152)
diff --git a/core/src/main/java/hudson/security/LDAPSecurityRealm.java b/core/src/main/java/hudson/security/LDAPSecurityRealm.java
index fbe5188b79ad0185a1821000357a4e1ba9aff821..37f94ac1b1d6d4eca30fc4ce4d7aed30abdbe6e9 100644
--- a/core/src/main/java/hudson/security/LDAPSecurityRealm.java
+++ b/core/src/main/java/hudson/security/LDAPSecurityRealm.java
@@ -325,8 +325,8 @@ public class LDAPSecurityRealm extends AbstractPasswordBasedSecurityRealm {
DirContext ctx = new InitialDirContext(props);
Attributes atts = ctx.getAttributes("");
Attribute a = atts.get("defaultNamingContext");
- if(a!=null) // this entry is available on Active Directory. See http://msdn2.microsoft.com/en-us/library/ms684291(VS.85).aspx
- return a.toString();
+ if(a!=null && a.get()!=null) // this entry is available on Active Directory. See http://msdn2.microsoft.com/en-us/library/ms684291(VS.85).aspx
+ return a.get().toString();
a = atts.get("namingcontexts");
if(a==null) {